Does FMC/FTD support ISE Tacacs+ device administration

[laurathaqi]

Hi all,

Do you know if FMC and FTD support ISE Tacacs+ device administration integration? So far, I did the router/switch and ASA integrations, but not able to find resources for the noted FTD and FMC ones!

Looking forward to hearing any thoughts or suggestions. 

Thank you,

Laura 

[balaji.bandi · Accepted solution]

how about using Radius ? as of i have tested 6.2

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/200204-Integration-of-FireSIGHT-System-with-ACS.html

May be need to read what 6.7 (any update on that)

[Rob Ingram · Accepted solution]

@laurathaqi 

No TACACS+ is still not supported on the FMC, you can use RADIUS.

Use the "class" RADIUS attributes in AuthZ profiles.

Class=Administrator

or

Class=SecAnalyst

And map these to roles in the FMC (System > Users > External Authentication).

So for example on the FMC if you want to configure the Security Analyst role then define Class=SecAnalyst or for administrator role define Class=Administrator.

HTH

[laurathaqi]

Hi @Rob Ingram @balaji.bandi 

Thank you for your feedback! Highly appreciated. Due to limited testing resources, I need to ask you if this is valid for only FMC or also FTD's?!

The solution you described, I found it on portals, as a solution to be enabling FMC GUI Authentication. My intentions are to do that for the CLI access of both FMC and also two FTDs 

Looking forward to hearing from you. 

Thank you,

Laura 

[balaji.bandi · Accepted solution]

Its for both, you can use Radius only with Attributes mentioned also provided link have all the information

any issue please let us know, happy to assists further.

[Rob Ingram · Accepted solution]

The RADIUS attributes values previously provided where for FMC. Use the following in AuthZ profile for FTDs

"Radius:Service-Type = Administrative (6)" << for Administrator
"Radius:Service-Type = Login (1)" << for non-administrator

[Marvin Rhoads · Accepted solution]

As the others have noted - plus make sure you tick the box to include shell authentication to make the setting apply to the cli logins on FMC and FTD. That's not selected by default.

[laurathaqi]

Dear community, 

Thank you very much for the support provided. I have followed your advices and resulted in a successful integration. 

This community is awesome. 

Thank you,

Laura 

[samarthashetty]

Hi Experts,

Is this supported in ver 6.7?

-Samarth

[Marvin Rhoads]

No it's not supported in any version - even in the latest version 7.2.

[balaji.bandi]

as per @laurathaqi input that works.

[samarthashetty]

@balaji.bandi  was that not for Radius?

-samarth